9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 10:11

Target

9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe
Size

140KB
MD5

548b2c4d653b97d3f1dac1ebc29abb98
SHA1

79a7f639ef255ea3ce14d624082339b0674958f7
SHA256

9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310
SHA512

6c8fae90b8bce84c847e5ebe171441b5f5f82e63f4cf7bccc604239dbe5f69753846e35fe5cf932c5883724861b006b136f1ed5f4f2e54f8438eaa99e93e0e89
SSDEEP

1536:MO6qziZ87wR3wiik0oLdSQeuYB6nCCZ8Vz2kjH3bJWqo2xgdyaO:fxcZ1iLGSd6CR1l34f2xB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 5032	3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 5032	3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	81
PID 3040 wrote to memory of 5032	3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	81
PID 3040 wrote to memory of 5032	3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	81
PID 3040 wrote to memory of 5032	3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	81
PID 3040 wrote to memory of 5032	3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	81
PID 3040 wrote to memory of 5032	3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	81
PID 3040 wrote to memory of 5032	3040	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	81
PID 5032 wrote to memory of 2736	5032	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	56
PID 5032 wrote to memory of 2736	5032	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	56
PID 5032 wrote to memory of 2736	5032	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	56
PID 5032 wrote to memory of 2736	5032	9e73f767d81b633bc0f666bc929cb526035e2b0076684b3ea046e4ae350e0310.exe	56

memory/2736-138-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/5032-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5032-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5032-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5032-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download